Deploy a Real-Time Online Game with CI/CD and DevSecOps

Create a GitHub repository for the bingo online game by initializing a public repo and pushing local node js source code using git bash.

Install git bash on Windows to push local source code to GitHub; download, install the latest git bash, launch the terminal, and push from your project folder.

Clone your GitHub repository to your local system using git clone, paste your source code into the local folder, and prepare to push in the next lecture.

Push your source code to a GitHub repository with git add, commit, and push, using a personal access token for authentication in CI/CD.

Push local source code to a GitHub repository using a personal access token, set up with two-factor authentication, token scopes, and a 30-day expiration, then verify the push.

Set up two Ubuntu 22.04 VMs on AWS for Jenkins and SonarQube servers, configure HTTP and HTTPS access, and prepare to install required packages.

Access the SonarQube and Jenkins servers via SSH, update the systems, and install Docker from the official apt repository. Ensure Docker runs as preparation for deploying SonarQube with Docker.

Authenticate the SonarQube server to Docker Hub by logging in, resolve normal user permission issues with Docker via sudo, and prepare to pull the SonarQube image for container deployment.

Launch and run a SonarQube container with Docker, mapping port 9000, naming the container, and verifying with docker ps to access via the public IP and port 9000.

Access the sonar cube server via port 9000, open inbound port rules, log in as admin/admin, update the password to admin 123, and use the server to scan the project.

Configure Jenkins on Ubuntu by installing Java 17+, following the official Jenkins install commands, installing Docker, and opening port 8080 in the security group to access the server.

Open port 8080 on the Jenkins server by configuring inbound rules in the security group and verify access via the Jenkins URL. The same group also serves sonar cube.

Configure the Jenkins server by retrieving and entering the administrator password, then customize Jenkins, install suggested plugins, create the first admin user, and prepare for further software installations alongside Sonarqube.

Install the required plugins on Jenkins to integrate tools such as Sonarqube, Java, NodeJS, Trivy, OWASP, and Docker by using Manage Jenkins, plugins, search, install, and restart.

Configure the JDK tool in Jenkins by adding a JDK 17 installation, enabling automatic installs, and installing from adoptme dotnet before saving the settings.

Configure the SonarQube scanner tool in Jenkins to integrate with a SonarQube server, naming the scanner and selecting version five, alongside the JDK tool.

Configure the node js tool in Jenkins, installing node js version 16 with automatic installation, and prepare npm, OWASP, and docker tools for the real-time online game ci/cd setup.

Install and configure the npm dependency check tool in Jenkins by adding the dependency check option, naming it DP, enabling automatic installation from GitHub, selecting the version, and saving.

Configure Docker tool in Jenkins by installing the latest version from docker.com, automatically downloaded, and integrate it with JDK, sonar cube scanner, and Node.js dependency check, then apply and save.

Generate a SonarQube token from the server, copy it, and create a Jenkins secret text credential named sonar-token under Manage Jenkins to use in pipelines.

Create a webhook on the SonarQube server to trigger actions after analysis completes and wait for quality gate to abort the pipeline if it fails.

Create a webhook on the Sonarqube server by naming it (for example, Jenkins), entering the Jenkins server URL, adding the Sonarqube-webhook with a trailing backslash, and clicking create.

Add Sonar Cube server details to the Jenkins server by configuring the Sonar Cube installation, setting the name and URL, and using existing credentials to establish the connection.

Configure a Jenkins ci/cd pipeline that checks out the bingo online source code from GitHub, sets up JDK 17 and NodeJS, and cleans the workspace as the first stage.

Add a new stage to the ci/cd pipeline on a Jenkins server to check out the project from a GitHub repository using the git command on the main branch.

Add a Sonar Cube analysis stage to the Jenkins pipeline, leveraging the existing Sonar Cube server and scanner for code analysis.

Configure a SonarQube project on the server, create a token, and insert the analysis command with withSonarQubeEnv into your pipeline for a NodeJS project on Linux.

Run the sonar cube analysis in the pipeline, review the sonar cube report for bugs, code smells, and security hotspots, fix issues in the source and rebuild.

Add a quality gate stage to the pipeline to determine progression after sonar cube analysis. Configure the script to wait for the quality gate signal via webhook and credentials.

Verify quality gate by running a build in Jenkins, observe the timestamp update from 333 to 341, and confirm a success status via the SonarQube webhook.

Add a stage to install Node.js dependencies with npm install in a Jenkins pipeline, using nvm, and review npm audit findings and vulnerabilities in the CI/CD workflow.

Add a Jenkins pipeline stage to run an OWASP scanning tool via dependency-check, generating an XML report to surface vulnerabilities in the Node.js project for dev teams.

Explore the OWASP report by accessing the Jenkins server, copying the XML report to the local system, and preparing it for developers using WinSCP and PuTTYgen.